IBM PC and Compatibles Virus Alerts

• Account notify
• E-mail account disabling warning.
• E-mail account security warning.
• Email account utilization warning.
• Email report
• E-mail technical support message.
• E-mail technical support warning.
• E-mail warning
• Encrypted document
• Fax Message Received
• Forum notify
• Hidden message
• Important notify
• Important notify about your e-mail account.
• Incoming message
• Notify about using the e-mail account.
• Notify about your e-mail account utilization.
• Notify from e-mail technical support.
• Protected message
• Re: Document
• Re: Hello
• Re: Hi
• Re: Incoming Fax
• Re: Incoming Message
• Re: Msg reply
• RE: Protected message
• RE: Text message
• Re: Thank you!
• Re: Thanks :)
• Re: Yahoo!
• Request response
• Site changes
• Warning about your e-mail account.

• Your e-mail account has been temporary disabled because of unauthorized access.
• Our main mailing server will be temporary unavailable for next two days, to continue receiving mail in these days you have to configure our free auto-forwarding service.
• Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information.
• We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions.
• Our antivirus software has detected a large amount of viruses outgoing from your email account, you may use our free anti-virus tool to clean up your computer software.
• Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions.

• AGENTSVR.EXE
• ANTI-TROJAN.EXE
• ANTI-TROJAN.EXE
• ANTIVIRUS.EXE
• ANTS.EXE
• APIMONITOR.EXE
• APLICA32.EXE
• APVXDWIN.EXE
• ATCON.EXE
• ATGUARD.EXE
• ATRO55EN.EXE
• ATUPDATER.EXE
• ATWATCH.EXE
• au.exe
• AUPDATE.EXE
• AUTODOWN.EXE
• AUTOTRACE.EXE
• AUTOUPDATE.EXE
• AVCONSOL.EXE
• AVGSERV9.EXE
• AVLTMAIN.EXE
• AVprotect9x.exe
• AVPUPD.EXE
• AVSYNMGR.EXE
• more listed on http ://vil.nai.com/vil/content/v_101095.htm
  

Please check the Network Associates web page for a current list of processes and subject lines. http ://vil.nai.com/vil/content/v_101095.htm

W32/Netsky.j@MM
March 8, 2004

Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
Risk Assessment: Medium
Minimum VirusScan DAT: 4335 (released 3/8/2004 2:30 pm HST)
Minimum VirusScan scan engine: 4.2.40
For more information: http://vil.nai.com/vil/content/v_101083.htm

Stinger Removal Tool: http://vil.nai.com/vil/stinger/

NAI raised the threat of this newly detected variant W32/Netsky.j@MM to MEDIUM due to increased prevalence and released DAT 4335 early to detect this new threat. Please update your McAfee DAT file to 4335 as soon as possible, using the manual Update Now m ethod.

Note: this variant is also known as W32.Netsky.k@MM by Symantec. To add to the confusion, NAI already has its own W32/Netsky.k@MM variant.

W32/Netsky.j@MM worm arrives via email with a spoofed or forged FROM address and a .PIF attachment (22,016 bytes).

• Be careful about opening unexpected attachments, even from people you know.
• Receiving email stating that your computer sent out a virus may not mean that your computer is infected as this virus spoofs the FROM address.
  

• contains its own SMTP server to send out infected email messages
  
  
• gathers email addresses from the infected computer
  The email addresses are gathered from these files:
  

  .adb	.asp	.cfg	.dbx	.eml	.htm	.html	.mdx
  .mmf	.nch	.ods	.php	.pl	.sht	.txt	.wab

• spoofs the FROM field using addresses harvested from the infected computer
   
• notification is sent to the hacker (virus author) about its infection
  The virus is careful not to send itself to email addresses that contain these words because it wants to avoid detection.
  

  @avp

  @hotmail.com

  @microsoft

  @msn.com

  local

  noreply

  postmaster@

  root@

  It tries to contact the virus author by calling PHP scripts on remote sites.
  
  http://permail.uni-muenster.de/scr.php
  http://www.songtext.net/de/scr.php
  http://www.sportscheck.de/scr.php
  At the time of this post, the script did not exist on these web sites.

• the infected computer has a remote control component and could be used at a later time
  The virus listens on TCP port 2745 for remote connections.
  
  
• increased activity on the SMTP traffic within a network
  
  
• the infected computer will have file i1ru74n4.exe (which is the virus itself) in the C:\WINNT\SYSTEM32 directory.
  
  It will also create other files in this directory:
  
  • godo.exe (18,944 bytes) - DLL to do the mailing
  • ii455nj4.exe (1,536 bytes) - DLL loader
  • i1ru74n4.exeopen (~16KB) - ZIP file to be sent in the email
  
  
• There are some registry changes so that the virus can start up every time the computer is booted.
  
  
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "rate.exe" = C:\WINNT\SYSTEM32\i1ru74n4.exe
  

  Additionally, the following Registry keys are added:

  • HKEY_CURRENT_USER\Software\DateTime2 "frun"
  • HKEY_CURRENT_USER\Software\DateTime2 "uid"
  • HKEY_CURRENT_USER\Software\DateTime2 "port"

  A mutex called "imain_mutex" is created to ensure only one instance of the worm is running at a time.

• The virus also tries to turn off any security services that are running on the computer.
  

  ATUPDATER.EXE	AUPDATE.EXE	AUTODOWN.EXE	AUTOTRACE.EXE	AUTOUPDATE.EXE
  AVLTMAIN.EXE	AVPUPD.EXE	AVWUPD32.EXE	AVXQUAR.EXE	CFIAUDIT.EXE
  DRWEBUPW.EXE	ICSSUPPNT.EXE	ICSUPP95.EXE	LUALL.EXE	MCUPDATE.EXE
  NUPGRADE.EXE	OUTPOST.EXE	UPDATE.EXE

   

   

  W32/Netsky.d@MM
  March 1, 2004
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4328 (released 2/25/2004)
  Minimum VirusScan scan engine: 4.2.40
  For more information: http://vil.nai.com/vil/content/v_101064.htm

  March 1, 2004 - NAI raised the threat level to MEDIUM due to increased prevalence. DAT 4328 (released 2/25/2004) or higher will proactively detect this variant with scanning of compressed files enabled.
  
  W32/Netsky.d is a virus that will spread via mass mailing. It has its own SMTP server that will make a direct connection to your mail server (e.g. mail.hawaii.edu) and sends out infected attachments (17,424 bytes) with a PIF extension to email addresses t hat it finds on the local system in address book files, word processing files (i.e. doc), and web files such as htm, asp, and cgi. Please see the list of file extensions below. The messages will impersonate (spoof) the sender's email address using addres ses found in these files. Do not open attachments that arrive with "return to sender" messages from people you do not know. Please delete these messages and purge them from your mail boxes.
  
  This is a list of files that Netsky uses to gather email addresses to impersonate (spoof).

  .adb	.asp	.cgi	.dbx	.dhtm	.doc	.eml
  .htm	.oft	.php	.pl	.rtf	.sht	.shtm
  .msg	.tbb	.txt	.uin	.vbs	.wab

  The worm arrives in an email message with the following characteristics:
  
  From: (forged or spoofed address from infected system)
  Subject:(one of the following)
  
  • Re: Hello
  • Re: Hi
  • Re: Thanks!
  • Re: Document
  • Re: Message
  • Re: Here
  • Re: Details
  • Re: Your details
  • Re: Approved
  • Re: Your document
  • Re: Your text
  • Re: Excel file
  • Re: Word file
  • Re: My details
  • Re: Your music
  • Re: Your bill
  • Re: Your letter
  • Re: Document
  • Re: Your website
  • Re: Your product
  • Re: Your document
  • Re: Your software
  • Re: Your archive
  • Re: Your picture
  • Re: Here is the document
  Body: (one of the following)
  
  • Here is the file.
  • Your file is attached.
  • Your document is attached.
  • Please read the attached file.
  • Please have a look at the attached file.
  • See the attached file for details.
  Attachment: filenames taken from strings within the worm, with a .PIF extension. Possible attachment names are:
  
  • yours.pif
  • your_text.pif
  • your_bill.pif
  • mp3music.pif
  • document.pif
  • my_details.pif
  • your_file.pif
  • your_website.pif
  • your_product.pif
  • your_letter.pif
  • your_archive.pif
  • your_details.pif
  • document_word.pif
  
  Netsky copies itself to the default Windows folder using the filename WINLOGON.EXE
  
  • c:\WINNT\WINLOGON.EXE (17,424 bytes)
    
    
  Note: a legitimate WINLOGON.EXE file exists in the Windows System directory.
  
  Netsky will also remove the registry edits made by previous viruses such as MyDoom, Netsky.a, and others. It will also remove some services from the registry. The virus removes various Registry values associated with other recent virus (W32/Netsky.a@MM, W32/Netsky.b@MM, W32/Mydoom.a@MM, W32/Mydoom.b@MM, W32/Mimail.t@MM).
  A registry key is created to load the worm on startup:
  
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "ICQ Net" = %WinDir%\WINLOGON.EXE - stealth

  Symptoms of Netsky.d are the existence of files and registry keys, unexpected network traffic, and outgoing DNS request to one of the following IP addresses.

  • 145.253.2.171
  • 151.189.13.35
  • 193.141.40.42
  • 193.189.244.205
  • 193.193.144.12
  • 193.193.158.10
  • 194.25.2.129
  • 194.25.2.130
  • 194.25.2.131
  • 194.25.2.132
  • 194.25.2.133
  • 194.25.2.134
  • 195.185.185.195
  • 195.20.224.234
  • 212.185.252.136
  • 212.185.252.73
  • 212.185.253.70
  • 212.44.160.8
  • 212.7.128.162
  • 212.7.128.165
  • 213.191.74.19
  • 217.5.97.137
  • 62.155.255.16
  Please use the Stinger tool to detect Netsky if you do not know what to do. The Stinger tool may be downloaded from http://vil.nai.com/vil/stinger/.

   

   

  W32/Bagle.c@MM
  Feb. 27, 2004
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4329 (released 2/27/2004 at 4:00 pm HST)
  Minimum VirusScan scan engine: 4.2.40
  For more information: http://vil.nai.com/vil/content/v_101059.htm Stinger Tool Available: Yes. http://vil.nai.com/vil/stinger/

  This is a mass-mailing worm that has the following characteristics:
  

  • contains its own SMTP server to send out infected email messages
    The body of the email messages are empty with a variety of subject lines. McAfee is still learning about this virus so these are only some of the subject lines - Accoutns department, Ahtung!, the employee, and Camila. The attachment is a small ZIP file th at contains a file that looks like an Excel file but it is an executable file.
    After the infected Excel file is executed, Notepad will appear with a blank window.
     
  • gleans email addresses from the infected computer
    The email addresses are gleaned from these files:
    

    .adb	.asp	.cfg	.dbx	.eml	.htm	.html	.mdx
    .mmf	.nch	.ods	.php	.pl	.sht	.txt	.wab

  • randomly places email addresses that it finds into the FROM field
     
  • notification is sent to the hacker (virus author) about its infection
    The virus is careful not to send itself to email addresses that contain these words because it wants to avoid detection.
    

    @avp

    @hotmail.com

    @microsoft

    @msn.com

    local

    noreply

    postmaster@

    root@

    It tries to contact the virus author by calling PHP scripts on remote sites.
    
    http://permail.uni-muenster.de/scr.php
    http://www.songtext.net/de/scr.php
    http://www.sportscheck.de/scr.php
    At the time of this post, the script did not exist on these web sites.

  • the infected computer has a remote control component and could be used at a later time
    The virus listens on TCP port 2745 for remote connections.
    
  • Besides the increased activity on the SMTP traffic within a network, the infected computer will have a README.EXE (which is the virus itself) in the C:\WINNT\SYSTEM32 directory. It will also create other files in this directory:
    
    • onde.exe - DLL to do the mailing
    • doc.exe - DLL loader
    • readme.exeopen - ZIP file to be sent in the email
  • There are some registry changes so that the virus can start up every time the computer is booted.
    
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "gouday.exe" = C:\WINNT\SYSTEM32\README.EXE
    

    Additionally, the following Registry keys are added:

    • HKEY_CURRENT_USER\Software\DateTime2 "frun"
    • HKEY_CURRENT_USER\Software\DateTime2 "uid"
    • HKEY_CURRENT_USER\Software\DateTime2 "port"

    A mutex called "imain_mutex" is created to ensure only one instance of the worm is running at a time.

  • The virus also tries to turn off any security services that are running on the computer.
    

    ATUPDATER.EXE	AUPDATE.EXE	AUTODOWN.EXE	AUTOTRACE.EXE	AUTOUPDATE.EXE
    AVLTMAIN.EXE	AVPUPD.EXE	AVWUPD32.EXE	AVXQUAR.EXE	CFIAUDIT.EXE
    DRWEBUPW.EXE	ICSSUPPNT.EXE	ICSUPP95.EXE	LUALL.EXE	MCUPDATE.EXE
    NUPGRADE.EXE	OUTPOST.EXE	UPDATE.EXE

     

     

    W32/Netsky.c@MM
    Feb. 25, 2004
    

    Platform: Windows 9x/ME/Windows NT/2000/XP, Windows S erver 2003
    Risk Assessment: Medium
    Minimum VirusScan DAT: 4328 (released 2/25/2004)
    Minimum VirusScan scan engine: 4.2.40
    For more information: http://vil.nai.com/vil/content/v_101048.htm

    W32/Netsky.c is a virus that will distirbute itself in 2 ways. The first is through email. It has its own SMTP server that will make a direct connection to your mail server (i.e. mail.hawaii.edu) and send out infected attachments to email addresses that i t finds in address book files, word processing files (i.e. doc), and web files such as htm, asp, and cgi. Please see the list below. The messages are designed to impersonate the person's email address found in these files. You might receive return to sen der messages from people that you do not know. Do not open these email's attachments. Please delete them and purge them from your mail boxes.
    This is a list of files that Netsky uses to glean email addresses to impersonate.

    .adb	.asp	.cgi	.dbx	.dhtm	.doc	.eml
    .htm	.oft	.php	.pl	.rtf	.sht	.shtm
    .msg	.tbb	.txt	.uin	.vbs	.wab

  The email attachment might have a double . extension so that it would be more difficult to detect. This a list of some common extensions. The first extension may be:

  • .doc
  • .htm
  • .rtf
  • .text
  
  The last extension is one of the following:
  • .com
  • .exe
  • .pif
  • .scr

  The second method is through peer-to-peer sharing or P2P (i.e. Kazaa). The virus will look for folder names that have "shar" inside of the name (i.e. C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB FOLDERS). The folders can be on your computer or a sha red folder from a server. It will copy itself into these folders and changes it name (i.e. MS Service Pack 5.exe or Microsoft Office 2003 Crack.exe) The full list of filenames can be found on http://vi l.nai.com/vil/content/v_101048.htm

  Netsky will also remove the registry edits made by previous viruses such as MyDoom, Netsky.a, and others. It will also remove some services from the registry. The virus removes various Registry values associated with other recent virus (W32/Netsky.a@MM, W32/Netsky.b@MM, W32/Mydoom.a@MM, W32/Mydoom.b@MM, W32/Mimail.t@MM).

  The following values:

  • Sentry
  • OLE
  • service
  • au.exe
  • d3dupdate.exe
  • DELETE ME
  • msgsvr32

  are deleted from CurrentVersion\Run CurrentVersion\RunServices Registry keys.

  The following Registry keys are also deleted:

  • HKEY_CLASSES_ROOT\CLSID\
    {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Run "KasperskyAv"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Run "system."

  Symptoms of Netsky.c are the existence of files and registry keys, unexpected network traffic, and outgoing DNS request to a variety or IP addresses.

  • 151.189.13.35
  • 193.141.40.42
  • 193.189.244.205
  • 193.193.144.12
  • 193.193.158.10
  • 194.25.2.129
  • 194.25.2.130
  • 194.25.2.131
  • 194.25.2.132
  • 194.25.2.133
  • 194.25.2.134
  • 195.185.185.195
  • 195.20.224.234
  • 212.185.252.136
  • 212.185.252.73
  • 212.185.253.70
  • 212.44.160.8
  • 212.7.128.162
  • 212.7.128.165
  • 213.191.74.19
  • 217.5.97.137
  • 62.155.255.16

  Manual Removal Instructions
  Note: Improper removal of registry keys could cause your Windows to crash or not function at all. Please use your antivirus software or call the ITS Help Desk for assistance (808) 956-8883.
  
  To remove this virus "by hand", follow these steps:

  1. Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
  2. Delete the file WINLOGON.EXE  from your WINDOWS directory (typically c:\windows or c:\winnt)
     NOTE: DO NOT delete the file WINLOGON.EXE from the WINDOWS SYSTEM directory as that is a valid Windows system file. (i.e. c:\windows\system, c:\windows\system32, c:\winnt\system, or c:\winnt\system32)
     
  
  
  3. Edit the registry
     • Delete the "ICQ Net" value from
       • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
         Windows\CurrentVersion\Run
       • HKEY_CURRENT_USERS\SOFTWARE\Microsoft\
         Windows\CurrentVersion\Run
  Please use the Stinger tool to detect Netsky if you do not know what to do. The Stinger tool may be downloaded from http://vil.nai.com/vil/stinger/.

   

   

  W32/Mydoom.f@MM
  Feb. 23, 2004
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4327 (released 2/23/2004)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/content/v_101038.htm

  W32/Mydoom.f@MM is a mass-mailing worm that is spread via email and by copying itself to mapped drives. It opens a backdoor on TCP port 1080 and can download and execute arbitrary files. It will perform a Denial of Service (DoS) attack on www.microsoft.co m and www.riaa.com, if the infected computer's system date is between the 17th and 22nd of the month. The worm searches drives C: to Z: and deletes files with .mdb, .doc, .xls, .sav, .jpg, .avi, and .bmp extensions. The outgoing messages have attac hment filenames with .cmd, .bat, .pif, .com, .scr, and .exe extensions, and may be contained in a .ZIP file. The icon of the attachment may make it appear to be a text file.
  
  The email has the following characteristics:
  From: (spoofed or forged address)
  Subject: (one of following)
  

• (blank)
  
• Announcement
  
• ApprovedNews
  
• Attention
  
• automatic responderbr>
• Bug
  
• Current Status
  
• EXPIRED ACCOUNT
  
• For your information
  
• hello
  
• hi, it's me
  
• hi
  
• IMPORTANT
  
• Information Warning
  
• Love is Love is...
  
• Please read
  
• Please reply
  
• Re: Approved
  
• Re: Thank You
  
• Re:
  
• Read it immediately
  
• read now!
  
• Read this
  
• Readme
  
• Recent news
  
• Something for you
  
• Undeliverable message
  
• Unknown
  
• You have 1 day left
  
• You use illegal File Sharing...
  
• Your IP was logged
  
• Your account is about to be expired
  
• Your credit card
  
• Your order is being processed
  
• Your order was registered
  
• Your request is being processed
  
• Your request was registered
  
  Body: (varies, such as)
  
• Check the attached document
  
• Details are in the attached document. You need Microsoft Office to open it.
  
• Greetings
  
• Here is the document.
  
• Here it is
  
• I have your password :)
  
• I wait for your reply.
  
• I'm waiting Okay
  
• I'm waiting
  
• Information about you
  
• Is that from you?
  
• Is that yours?
  
• Kill the writer of this document!
  
• OK Everything ok?
  
• Please see the attached file for details
  
• Please, reply
  
• Read the details.
  
• Reply
  
• See the attached file for details
  
• See you Here it is
  
• See you
  
• Something about you
  
• Take it
  
• The document was sent in compressed format.
  
• We have received this document from your e-mail.
  
• You are a bad writer
  
• You are bad
  
  Attachment: (variable filename with .cmd, .bat, .pif, .com, .scr, .exe extension or may be contained in a .ZIP file)
  
• creditcard.bat
  
• creditcard.zip
  
• details.zip
  
• mail.zip
  
• notes.zip
  
• part1.zip
  
• paypal.zip
  
• photo.zip
  
• textfile.zip
  
• vpf.zip
  
• website.zip
  
• %random characters%.zip
  
  The icon for the attachment may make it appear to be a text file.
  
  It copies itself to the WINDOWS SYSTEM directory using random filenames, e.g. hiruszomrk.exe (%SYSDIR%hiruszomrk.exe).
  
  It creates a registry key to load itself on startup:
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run "nhch" = %SYSDIR%\hiruszomrk.exe
  It also uses a DLL that it creates in the Windows System directory as:
  
  %SYSDIR%\vppu.dll (8,068 bytes)
  The worm copies itself as .ZIP or .EXE files in different directories on the local hard drive and mapped drives. The filenames are random and 34 Kbytes in size. The worm searches the %System% folder on drives C: through Z: and deletes files with .b mp, .avi, .jpg, .sav, .xls, .doc, and .mdb extensions.
  
  The worm harvests email addresses from files on drives C: to Z:, Temporary Internet Files folder (Internet Explorer web browser cache), and the Windows address book. It uses its own SMTP engine to construct outgoing messages.
  
  The worm checks current running processes and attempts to shut down anti-virus and other processes.
  
  If the system date is between the 17th and 22nd of the month, it performs a Denial of Service (DoS) attack on www.microsoft.com and www.riaa.com using random ports on the infected computers.
  
  The worm listens on TCP port 1080 and opens ports from 3000 through 5000.
  
  If you are infected, please make sure you have the McAfee DAT file 4327 (released on Feb. 23, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm. The stand-alone Stinger removal tool (v.2.0.3, 2/23/04) has been updated to detect and clean this threat.
  
  

   

   

  W32/Netsky.b@MM
  Feb. 18, 2004
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4325 (released 2/18/2004)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/conten t/v_101034.htm

  W32/Netsky.b@MM is a mass-mailing worm that is spread via email and by copying itself to folders named share or sharing on the local system and mapped network drives. This results in virus propagation via KaZaa, Bearshare, Limewire, and othe r P2P applications that use shared folders named share or sharing. It also attempts to deactivate the W32/Mydoom.a@MM and W32/Mydoom.b@MM viruses. The outgoing messages have attachment filenames with a double extension, such as .rtf.pif, and may be contai ned in a .ZIP file.
  
  The email has the following characteristics:
  From: (spoofed or forged address taken from infected system) or skynet@skynet.de
  Subject: (one of following)
  

• fake
  
• for
  
• hello
  
• hi
  
• immediately
  
• information
  
• it
  
• read
  
• something
  
• stolen
  
• unknown
  
• warning
  
• you
  
  Body: (one of following)
  
• about me
  
• anything ok?
  
• do you? that's funny
  
• from the chatter
  
• greetings
  
• here
  
• here is the document.
  
• here it is
  
• here, the cheats
  
• here, the introduction
  
• here, the serials
  
• i found this document about you
  
• I have your password!
  
• i hope it is not true!
  
• i wait for a reply!
  
• i'm waiting ok
  
• information about you
  
• is that from you?
  
• is that true?
  
• is that your account?
  
• is that your name?
  
• kill the writer of this document!
  
• my hero
  
• read it immediately!
  
• read the details.
  
• reply
  
• see you
  
• something about you!
  
• something is fool
  
• something is going wrong
  
• something is going wrong!
  
• take it easy
  
• that is bad
  
• thats wrong why?
  
• what does it mean?
  
• yes, really?
  
• you are a bad writer
  
• you are bad
  
• you earn money
  
• you feel the same
  
• you try to steal
  
• your name is wrong
  
  Attachment: (random filename with double extension or may be contained in a .ZIP file, size 22,016 bytes, one of following)
  
• aboutyou
  
• attachment
  
• bill
  
• concert
  
• creditcard
  
• details
  
• dinner
  
• disco
  
• doc
  
• document
  
• final
  
• found
  
• friend
  
• jokes
  
• location
  
• mail2
  
• mails
  
• me
  
• message
  
• misc
  
• msg
  
• nomoney
  
• note
  
• object
  
• part2
  
• party
  
• posting
  
• product
  
• ps
  
• ranking
  
• release
  
• shower
  
• story
  
• stuff
  
• swimmingpool
  
• talk
  
• textfile
  
• topseller
  
• website
  
  followed by .doc, .htm, .rtf, or .txt and ending with .com, .exe, .pif, and .scr.
  
  The virus gathers email addresses from files on the infected computer with .adb, .asp, .dbx , .doc, .eml, .htm, .html, .msg, .oft, .php, .pl, .rtf, .sht, .tbb, .txt, .uin, .vbs, .wab extensions. It mails itself to harvested email addresses using its own S MTP engine to construct messages.
  
  Upon execution, a fake error message (The file could not be opened!) may be displayed.
  
  It copies itself to the default WINDOWS directory (c:\windows for Windows XP, c:\winnt for Windows NT/2000, c:\windows for Windows 95/98/ME) as SERVICES.EXE. Note: there is a legitimate Windows services.exe file in the WINDOWS SYSTEM directory.
  
  It creates a registry key to load itself on startup:
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run "service" = C:\WINNT\services.exe -serv
  The worm copies itself to the share or sharing folder on the local system and on mapped network drives using one of the following filenames:
  
• angels.pif
  
• cool screensaver.scr
  
• dictionary.doc.exe
  
• dolly_buster.jpg.pif
  
• doom2.doc.pif
  
• e.book.doc.exe
  
• e-book.archive.doc.exe
  
• eminem - lick my pussy.mp3.pif
  
• hardcore porn.jpg.exe
  
• how to hack.doc.exe
  
• matrix.scr
  
• max payne 2.crack.exe
  
• nero.7.exe
  
• office_crack.exe
  
• photoshop 9 crack.exe
  
• porno.scr
  
• programming basics.doc.exe
  
• rfc compilation.doc.exe
  
• serial.txt.exe
  
• sex sex sex sex.doc.exe
  
• strippoker.exe
  
• virii.scr
  
• win longhorn.doc.exe
  
• winxp_crack.exe
  
  The worm also drops many .ZIP files containing the worm (22,016 bytes). The compressed file usually uses a filename with a double extension, such as .doc.pif, .rtf.com, .rtf.scr. These are the .ZIP filenames:
  
• aboutyou.zip
  
• attachment.zip
  
• bill.zip
  
• concert.zip
  
• creditcard.zip
  
• details.zip
  
• dinner.zip
  
• disco.zip
  
• final.zip
  
• found.zip
  
• friend.zip
  
• jokes.zip
  
• location.zip
  
• mail2.zip
  
• mails.zip
  
• me.zip
  
• message.zip
  
• misc.zip
  
• msg.zip
  
• nomoney.zip
  
• note.zip
  
• object.zip ,br>
• part2.zip
  
• party.zip
  
• posting.zip
  
• product.zip
  
• ps.zip
  
• ranking.zip
  
• release.zip
  
• shower.zip
  
• story.zip
  
• stuff.zip
  
• swimmingpool.zip
  
• talk.zip
  
• textfile.zip
  
• topseller.zip
  
• website.zip
  
  The worm also removes registry keys associated with W32/Mydoom.a@MM and W32/Mydoom.b@MM viruses.
  
  If you are infected, please make sure you have the McAfee DAT file 4325 (released on Feb. 18, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm. The stand-alone Stinger removal tool (v.2.0.2, 2/18/04) has been updated to detect and clean this threat.
  
  

  W32/Bagle.b@MM
  Feb. 17, 2004
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4324 (released 2/17/2004)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/conten t/v_101030.htm

  The ITS mail server (mail.hawaii.edu) is scanning for this threat. W32/Bagle.b@MM is a mass-mailing worm that is from a spoofed address. It listens on TCP port 8866 for remote connections. The outgoing messages have random attachment names with .EXE file extension (11,264 bytes). If the system date is Feb. 25, 2004 or later, the virus does not propagate.
  
  The email has the following characteristics:
  
  From: (address is spoofed)
  Subject: ID (random string)... thanks
  Body:
  Yours ID (random string2)
  --
  Thank
  Attachment: (random filename with .EXE extension, size 11,264 bytes)
  
  The virus gathers email addresses from files on the infected computer with .wab, .txt, .htm, and .html extensions. It mails itself to harvested email addresses using its own SMTP engine. However, it doesn't mass-mail itself to addresses that include @hotm ail.com, @msn.com, @microsoft, and @avp.
  
  The virus listens to TCP port 8866 for remote connections. This use of this backdoor is being investigated by NAI.
  
  A notification is sent to the author via HTTP. A GET request with port number and "id" is sent to a PHP script on remote servers. Block access to the following domains:
  

• http://www.47df.de
  
• http://www.strato.de
  
• http://intern.games-ring.de
  
  When the attachment is run and the system date is Feb. 25, 2004 or later, the virus exits and doesn't propagate.
  
  If the system date is before Feb. 25, 2004, the virus runs the standard Windows Sound Recorder program (SNDREC32.EXE). The virus uses the same icon as the Windows Sound Recorder.
  
  
  
  It also copies itself to the Windows System directory (c:\windows\system32 for Windows XP, c:\winnt\system32 for Windows NT/2000, c:\windows\system for Windows 95/98/ME) as au.exe.
  
  It creates a registry key to load itself on startup:
  
  
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
  Run "au.exe" = C:\WINNT\System32\au.exe
  
  It creates two additional registry keys:
  
  
  HKEY_CURRENT_USER\Software\Windows2000 "frn"
  HKEY_CURRENT_USER\Software\Windows2000 "gid"
  
  If you are infected, please make sure you have the McAfee DAT file 4324 (released on Feb. 17, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm. The stand-alone Stinger removal tool (v.2.0.1, 2/17/04) has been updated to detect and clean this threat.
  
  

  W32/Mimail.s@MM
  Jan. 29, 2004
  

  Platform: Windows 9x/ME, Windows NT/2000/XP
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4321 (released 1/29/04)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/content/v_100989.htm

  
  Please update your McAfee DAT to 4321 as soon as possible.
  
  W32/Mimail.s@MM is a mass-mailing worm that attempts to steal credit card information by displaying a fake message that your Microsoft Windows license has expired.
  
  The worm harvests email addresses by appending .org, .net or .com to strings from files on an infected computer. The harvested email addresses are saved in c:\windows\outlook.cfg. The worm has its own SMTP engine to construct email messages with varying subject lines, message bodies and attachment names.
  
  For example,
  Subject: here is the file you asked for
  Body: Hi! Here is the file you asked for!
  Attachment: document.txt.scr
  
  Possible attachment file extensions include:
  

• .pif
  
• .scr
  
• .exe
  
• .jpg.pif
  
• .jpg.scr
  
• .jpg.exe
  
• .gif.pif
  
• .gif.scr
  
• .gif.exe
  

  When the attachment is run, a fake error message is displayed.
  
  

  The worm checks if a credit card is entered and displays an error message if a dummy number is entered.
  
  

  Stolen credit card numbers are sent to email addresses found in the worm's body in the mail15.com and ziplip.com domains. The stolen information is saved in c:\xx.
  
  When the attachment is opened, the worm copies itself to c:\Windows\rabbit.exe and c:\Windows\x (worm body).
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\Run "RabbitWannaHome" = %WinDir%\rabbit.exe
    
  If you are infected, please make sure you have the McAfee DAT file 4321 (released on Jan. 29, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm.
  
  

  W32/Mydoom@MM
  (alias W32.Novarg.A@MM, Novarg, Win32/Shimg)
  Jan. 26, 2004
  

  Platform: Windows 9x/ME, Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: High Outbreak
  Minimum VirusScan DAT: 4319 (released 1/26/04 6:35 pm HST)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/content/v_100983.htm

  
  Please update your McAfee DAT to 4319 as soon as possible. The date of the virus definition will appear as Jan. 27, 2004 in VirusScan.
  
  NAI has updated the Stinger removal tool (v1.9.7, 1/26/04) to detect and repair W32/Mydoom@MM. You must reboot after running Stinger to complete the repair. Note: Windows ME/XP users need to disable system restore before running Stinger.
  
  This mass-mailing and peer-to-peer file-sharing worm arrives in email with the following characteristics:
  
  From: (spoofed)
  Subject: (Random) possible subject lines:

• test
  
• hi
  
• hello
  
• Mail Delivery System
  
• Mail Transaction Failed
  
• Server Report
  
• Status
  
• Error
  Body: (Varies, such as)
  
  • The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
    
  • The message contains Unicode characters and has been sent as a binary attachment.
    
  • Mail transaction failed. Partial message is available.
    
  Attachment: (varies [.exe, .pif, .cmd, .scr] - often arrives in a ZIP archive) (22,528 bytes)
  
  The icon for the attachment makes it appear to be a text file. Attachment file names are common names but may be random. Examples include:
  
  
• document.scr
  
• doc.bat
  
• document.zip
  
• message.zip
  
• readme.zip
  
• text.pif
  
• hello.cmd
  
• body.scr
  
• test.htm.pif
  
• data.txt.exe
  
• file.scr
  
  When the attachment is opened, Notepad opens filled with garbage characters. It copies itself to the local system with filenames:
  
  • c:\Program Files\KaZaa\My Shared Folder\activation_crack.scr
    
  • %SysDir%\taskmon.exe
    
  where %SysDir% is the Windows System directory.
  
  It creates the file shimgapi.dll (4,096 bytes) in the Windows System directory. This DLL is injected into EXPLORER.EXE upon reboot via registry key:
  
  
• HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 "(Default)" = %SysDir%\shimgapi.dll
  
  It creates the registry entry to hook Windows startup:
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
    
  The worm opens a connection on TCP port 3127 suggesting remote control. On the first system startup after Feb. 2, 2004, the worm changes its behavior to start a denial of service (DoS) attack against the sco.com domain. The DoS attack will stop on Feb. 12 , 2004.
  
  The worm copies itself in the KaZaa Shared Directory with filenames such as:
  
• winamp5
  
• icq2004-final
  
• activation_crack
  
• strip-girl-2.0bdcom_patches
  
• rootkitXP
  
• office_crack
  
• nuke2004
  
  with file extensions .pif, .scr, or .bat.
  
  The worm harvests email addresses from the local system from files with the following extensions:
  
• wab
  
• adb
  
• tbb
  
• dbx
  
• asp
  
• php
  
• sht
  
• htm
  
• txt
  
  If you are infected, please make sure you have the McAfee DAT file 4319 (released on Jan. 27, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm.
  
  

  W32/Dumaru.y@MM
  Jan. 26, 2004
  

  Platform: Windows 9x/ME, Windows NT/2000/XP
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4318 (released 1/26/2004)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/content/v_100980.htm

  The ITS mail server (mail.hawaii.edu) is scanning for this threat. W32/Dumaru.y@MM is a mass-mailing worm that steals data and allows a remote hacker to run commands on your computer, listening on TCP ports 2283 and 10000. The worm captures keystrokes dur ing web browser sessions, targetting online banking essions.
  
  The email has the following characteristics:
  
  From: "Elene" (F (removed) ENSUICIDE@HOTMAIL.COM) (profanity removed)
  Subject: Important information for you. Read it immediately !
  Body: Here is my photo, that you asked for yesterday.
  Attachment: myphoto.zip
  
  The attachment expands to myphoto.jpg (many spaces).exe.
  
  The worm gathers email addresses from files on the infected computer with .htm, .wab, .html, .dbx, .tbb, and .abd extensions. It mails itself to harvested email addresses using its own SMTP engine.
  
  When executed, the worm also copies itself on the infected computer:

  • %WinDir%\RUNDLLX.SYS
    
  • %SysDir%\L32X.EXE
    
  • %SysDir%\VXD32V.EXE
    
  where %WinDir% is the Windows directory (e.g. C:\WinNT) and %SysDir% is the Windows System directory (c:\windows\system32 for Windows XP, c:\winnt\system32 for Windows NT/2000, c:\windows\system for Windows 95/98/ME).
  
  It creates a registry key:
  
  
  HKEY_LOCAL_MaACHINE\Software\SARS
  
  If you are infected, please make sure you have the McAfee DAT file 4318 (released on Jan. 26, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm.
  
  

  W32/Bagle@MM
  Jan. 19, 2004
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4316 (released 1/18/2004)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/conten t/v_100965.htm

  The ITS mail server (mail.hawaii.edu) is scanning for this threat. W32/Bagle@MM is a mass-mailing worm that pretends to be a test message and is from a spoofed address. It listens on TCP port 6777 for remote connections. The outgoing messages have random attachment names. If the system date is Jan. 28, 2004 or later, the virus does not propagate.
  
  The email has the following characteristics:
  
  From: (address may be forged)
  Subject:Hi
  Body:
  Test =)
  (random characters)
  --
  Test, yep.
  Attachment: (random filename, size 15,872 bytes)
  
  The virus gathers email addresses from files on the infected computer with .wab, .txt, .htm, and .html extensions. It mails itself to harvested email addresses using its own SMTP engine. However, it doesn't mass-mail itself to addresses that include @hotmail.com, @msn.com, @microsoft, and @avp.
  
  The virus listens to TCP port 6777 that allows a remote attacker to execute commands on the local system, download executables to the local system, and terminate and delete the worm program.
  
  When the attachment is run and the system date is Jan. 28, 2004 or later, the virus exits and doesn't propagate. If the system date is before Jan. 28, 2004, the virus runs the standard Windows calculator program (calc.exe). It also copies itself to the Windows System directory (c:\windows\system32 for Windows XP, c:\winnt\system32 for Windows NT/2000, c:\windows\system for Windows 95/98/ME) as bbeagle.exe.
  
  It creates a registry key to load itself on startup:
  
  

  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
  Run "d3dupdate.exe" = C:\WINNT\System32\bbeagle.exe
  
  It creates two additional registry keys:
  
  
  HKEY_CURRENT_USER\Software\Windows98 "frun"
  HKEY_CURRENT_USER\Software\Windows98 "uid"
  
  If you are infected, please make sure you have the McAfee DAT file 4316 (released on Jan. 18, 2004) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm. The stand-alone Stinger removal tool has been updated to detect and clean this threat.
  
  

  W32/Sober.c@MM
  Dec. 22, 2003
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4310 (released 12/21/2003)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/conten t/v_100912.htm

  Network Associates has raised the alert level of W32/Sober.c@MM to MEDIUM risk due to increased prevalence. Please update your DAT file to 4310 (released 12/21/03) as soon as possible. The ITS mail server (mail.hawaii.edu) is scanning for this threat.
  
  W32/Sober.c@MM is a mass-mailing worm written in Visual Basic. The outgoing messages have varying subject lines, message bodies and attachment names (in either English or German). There are two worm processes running on the infected computer to ensure tha t the worm stays memory resident.
  
  Summary of the worm:
  

  • contains its own SMTP engine for constructing messages
  • target email addresses are harvested from the infected computer
  • the worm may have garbage at the end of the file (its file size may be larger than 74,223 bytes)

  The email has the following characteristics:
  
  Subject: (possible subject lines)
  

  • Betr: Klassentreffen
  • Testen Sie ihren IQ
  • Bankverbindungs- Daten
  • Neuer Dialer Patch!
  • Ermittlungsverfahren wurde eingeleitet
  • Ihre IP wurde geloggt
  • Sie sind ein Raubkopierer
  • Sie tauschen illegal Dateien aus
  • Ich hasse dich
  • Ich zeige sie an!
  • Sie Drohen mir
  • you are an idiot
  • why me?
  • I hate you
  • Preliminary investigation were started
  • Your IP was logged
  • You use illegal File Sharing ...
  Attachment: (possible filenames)
  
  • www.iq4you-german-test.com
  • www.freewantiv.com
  • www.free4manga.com
  • www.free4share4you.com
  • www.tagespolitik-umfragen.com
  • www.onlinegamerspro-worm.com
  • www.freegames4you-gzone.com
  • www.boards4all-terror432.com
  • www.anime4allfree.com
  • www.animepage43252.com
  • yourmail
  • alledigis
  • aktenz
  Attachments may end with a .com, .bat, .cmd, .pif, .scr, .exe or .com extension, and may be preceeded with a .txt or .doc, and/or a random number.
  
  

  When the attachment is run, a fake error message is displayed. For example:
  

  The worm installs itself into the default Windows System directory %SysDir% (c:\windows\system32 or c:\winnt\system32) as SYSHOSTX.EXE. Two other copies of the worm are dropped into %SysDir%, with varying filenames. For example:
  

  • %SysDir%\ONDMONSTR.EXE
    
  • %SysDir%\DATMSCRYPT.EXE
    
  These two files are responsible for monitoring and maintaining that the worm stays memory resident. Upon termination of one worm process, another copy is quickly restarted.
  
  It modifies the registry so the worm is run on system startup, where "string" varies between infections.
  
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
  Run "(string)" = %SysDir%\ONDMONSTR.EXE
  
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
  Run "(string)" = %SysDir%\ONDMONSTR.EXE
  
  If you are infected, please make sure you have the McAfee DAT file 4310 (released on Dec. 21, 2003) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm.
  
  

  W32/Mimail.i@MM
  November 14, 2003
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4304 (released 11/14/2003)
  Minimum VirusScan scan engine: 4240
  For more information: http://vil.nai.com/vil/conten t/v_100822.htm

  Network Associates has raised the alert level of W32/Mimail.i@MM to MEDIUM risk due to increased prevalence. Please update your DAT file to 4304 (released 11/14/03) as soon as possible.
  
  W32/Mimail.i@MM is a mass-mailing worm which attempts to steal credit card information by displaying a fake PayPal message, announcing the expiration of your PayPal account. It spreads with attachment www.paypal.com.scr or paypal.asp.scr.
  
  Summary of the worm:
  

  • contains its own SMTP engine for constructing messages
  • mails itself as www.paypal.com.scr or paypal.asp.scr attachment
  • uses email addresses harvested from the local computer

  The email has the following characteristics:
  

  When the attachment is run, the following window is displayed:
  

  The worm installs itself into the default Windows directory %WinDir% as SVCHOST32.EXE (12,832 bytes). The worm creates the following files:
  

  • c:\pp.gif (paypal icon)
    
  • c:\pp.hta (graphical interface)
    
  • c:\ppinfo.sys (your credit card details)
    
  • %WinDir%\ee98af.tmp (copy of the worm)
    
  • %WinDir%\el388.tmp (harvested email addresses)
    
  • %WINDIR%\svchost32.exe (copy of the worm)
    
  • %WinDir%\zp3891.tmp
    
  It modifies the registry so the worm is run on system startup.
  
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
  Run "SvcHost32" = %WinDir%\svchost32.exe
  
  If you are infected, please make sure you have the McAfee DAT file 4304 (released on Nov. 14, 2003) and a scan engine of 4.2.40 or higher. You may run a scan on all files to detect and clean up this worm.
  
  

  W32/Mimail.c@MM
  October 31, 2003
  

  Platform: Windows 9x/ME/Windows NT/2000/XP, Windows Server 2003
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4301 (released 10/31/2003)
  Minimum VirusScan scan engine: 4160
  For more information: http://vil.nai.com/vil/conten t/v_100795.htm

  Network Associates has raised the alert level of W32/Mimail.c@MM to MEDIUM risk due to increased prevalence. Please update your DAT file to 4301 as soon as possible.
  
  The worm was initially "seeded" by mass-spamming with attachment undelivered.hta which creates the file c:\mware.exe. This executable is the worm, W32/Mimail.c@MM. When the .hta file is run, the following message is displayed:
  
  

  Your message will be sent again in 1 hour. If it doesn't arrive - we will delete it from the queue.
  W32/Mimail.c@MM is a mass-mailing worm which spreads with attachment PHOTOS.ZIP (contains PHOTOS.JPG.EXE) and can cause a denial of service attack.
  
  Summary of the worm:
  
  • contains its own SMTP engine for constructing messages
  • mails itself as PHOTOS.ZIP attachment
  • uses email addresses harvested from the local computer
  • sends large amounts of data (garbage) to remote servers (port 80 and ICMP)

  The email has the following characteristics:
  

  The worm installs itself into the default Windows directory %WinDir% as NETWATCH.EXE (12,832 bytes). Three other files are dropped into the default Windows directory:
  

  • %WinDir%\EMP.TMP - list of email addresses harvested from the victim's computer
    
  • %WinDir%\EXE.TMP - copy of the worm
    
  • %WinDir%\ZIP.TMP - a ZIP archive containing the worm
    
  It modifies the registry so the worm is run on system startup.
  
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
  Run "NetWatch32" = C:\WINNT\NETWATCH.EXE
  
  If you are infected, please make sure you have the McAfee DAT file 4301 (released on October 31, 2003) and a scan engine of 4.2.60. You may run a scan on all files to detect and clean up this worm.
  
  If you need assistance, please call the ITS Help Desk (808) 956-8883 or toll-free from neighbor islands (800) 558-2669.

   

   

  W32/Swen@MM
  September 18, 2003
  

  Platform: Windows 9x/ME/Windows NT/2000/XP
  Risk Assessment: Medium (for Home Users)
  Minimum VirusScan DAT: 4294 (released 9/18/2003)
  Minimum VirusScan scan engine: 4160
  For more information: http://vil.nai.com/vil/conten t/v_100662.htm

  
  Network Associates has raised the alert level of W32/Swen@MM to MEDIUM risk for Home Users due to increased prevalence of this worm.
  
  In some cases, it pretends to be a Microsoft Security Update. It can also impersonate mail delivery failure notices and attaches itself as a randomly named executable.
  
  It terminates various processes including Regedit, ZoneAlarm, BlackIce, VirusScan, Norton Antivirus, F-Prot, Esafe, and others. It spreads via various mechanisms including:
  

  • mailing itself to email addresses extracted from files on the victim computer
  • copying itself over network shares (mapped drives)
  • sharing itself over the KaZaa P2P network
  • sending itself via IRC
  The virus contains its own SMTP engine to construct outgoing email messages. Multiple subject lines and attachment names are constructed from strings within the worm to be used in outgoing messages. Target email addresses are extracted from files on the victim computer.

  Sample of the email pretending to be a Microsoft Security Update
  

  
  The worm copies itself to the startup folder on mapped network drives using a random filename.
  
  The worm drops a SCRIPT.INI file (123 bytes) into the mIRC program folder to propagate via IRC (using dcc send).
  
  The worm copies itself in a directory (random name) within the system temp directory, using suggestive names such as

• SIRCAM CLEANER.EXE
  
• YAHOO HACKER.EXE
  
• HALLUCINOGENIC SCREENSAVER.EXE
  
• etc
  
  Symptoms
  
• Display of fake message boxes to install Microsoft Security Update
  
• Unexpected termination of anti-virus or security programs
  
• Inability to run RegEdit on the victim computer
  
  Various registry keys are modified to hook the execution of .BAT, .COM, .EXE, .PIF, .REG, and .SCR files.
  
  If you are infected, please make sure you have the McAfee DAT file 4294 (released on September 18, 2003) and a scan engine of 4.2.60. You may run a scan on all files to detect and clean up this worm.
  
  If you need assistance, please call the ITS Help Desk (808) 956-8883 or toll-free from neighbor islands (800) 558-2669.

   

   

  W32/Dumaru.a@MM
  August 28, 2003
  

  Platform: Windows 9x/ME/Windows NT/2000/XP
  Risk Assessment: Medium
  Minimum VirusScan DAT: 4290 (released 8/28/2003)
  Minimum VirusScan scan engine: 4140
  For more information: http://vil.nai.com/vil/conten t/v_100560.htm

  
  Network Associates has raised the alert level of W32/Dumaru.a@MM from low to medium risk. W32/Dumaru.a@MM is a mass mailing worm, with its own SMTP engine, that will send email to addresses found in the following files on the infected computers hard drive :
  

  • .htm
  • .wab
  • .html
  • .dbx
  • .tbb
  • .abd
  The email message will look like it is from Microsoft Security ("Microsoft" security@microsoft.com) and it will have an attachment called patch.exe. The patch.exe file carries the worm. If you receive a message with Microsoft security and a patch.exe, ple ase DELETE it immediately. Microsoft does not email any of their security patches to customers (http://www.microsoft.com/technet/treeview/default.asp?u rl=/technet/security/policy/swdist.asp).

  Sample of the email
  

  This worm might have a password stealer within it. If it does, McAfee VirusScan will detect the password stealer as PWS-Narod. It will also infect exe files on NTFS volumes using streams.
  
  How to Clean
  To remove this virus "by hand", follow these steps:
  

  1. Win9x/ME - Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode
     WinNT/2K/XP - Terminate the processes: LOAD32.EXE VXDMGR32.EXE DLLREG.EXE
  2. Delete the following files:
     
     • %WinDir%\DLLREG.EXE
     • %SysDir%\LOAD32.EXE
     • %SysDir%\VXDMGR32.EXE
     
     Note:
     %WINDIR% is the c:\windows or c:\winnt
     %SYSDIR% is c:\windows\system or c:\winnt\system
     
     
  3. Edit the registry
     
     • Delete the "Load32" value from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run
     • Edit the "Run" value in the following key from "C:\WINDOWS\DLLREG.EXE" to "": HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
     • Edit the "Shell" value in the following key from "explorer.exe %sysdir%\vxdmgr32.exe" to "explorer.exe": HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon